Computer system security dashboard

• US 10,031,646 B2
• Filed: 12/29/2011
• Issued: 07/24/2018
• Est. Priority Date: 09/07/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Pearcy, Derek Patton, Heinrich, Jessica Anne, Phillips, Craig Anthony
• Primary Examiner(s): Ulrich, Nicholas
• Application Number:
  US13/340,010
• Publication Number:
  US 20130061169A1
• Time in Patent Office: 2,399 Days
• Field of Search: 715735-737, 715759, 715781, 715783, 715788, 715791-793, 715795, 715796, 715800, 715801, 726 2- 26
• CPC Class Codes: G06F 11/328 Computer systems status display G06F11/327 takes precedence
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range

Abstract

A computing system security dashboard is provided for presentation on a computer display device, the dashboard including a plurality of security view panes. Each security view pane, when expanded, presents a respective visualization of security conditions of a particular computing system. When the particular security view pane is collapsed it can hide at least a portion of particular visualizations of security conditions presented using the particular security view pane when expanded. The particular security view pane occupies a smaller area of the dashboard when collapsed than when expanded. A particular visual indicator is presented on the particular security view, at least when collapsed, summarizing at least a portion of the particular security conditions identified in the particular visualizations. A user interaction with the particular collapsed security view pane can prompt the particular security view pane to be expanded in area and present the particular visualizations.

Claims

1. At least one non-transitory machine accessible storage medium having instructions stored thereon, wherein the instructions, when executed on a machine, cause the machine to:

receive data describing security conditions detected in a particular computing system by one or more security sensors;

provide a computing system security dashboard for presentation on a computer display device, the dashboard including a plurality of security view panes, each security view pane, when expanded, presenting a respective visualization of a corresponding category of security conditions of the particular computing system, wherein at least one particular security view pane is collapsed so as to hide at least a portion of a particular visualization of particular security conditions related to a particular category,

the particular security view pane is to occupy a smaller area of the dashboard when collapsed than when expanded and is to present a particular visual indicator, at least when collapsed, summarizing at least a portion of the particular security conditions represented in the hidden particular visualization,

the particular visualization is to graphically represent chronological progress of the particular security conditions over a period of time and at least one indication of whether a critical event has been detected with respect to the chronological progress of the particular security conditions during at least one portion of the period of time, and the particular security conditions are for each element of the group consisting of processors, memory, storage, storage access, software update, and network traffic; and

identify a user interaction with the particular collapsed security view pane prompting the particular security view pane to be expanded in area and to present the particular visualization.

2. The storage medium of claim 1, wherein the particular visual indicator identifies representation of a particular security condition in the particular visualization.

3. The storage medium of claim 2, wherein the particular security condition is at least one of a critical security event, abnormality, vulnerability, or threat detected by at least one security tool.

4. The storage medium of claim 2, wherein the particular visual indicator is a stoplight indicator presented in red for detection of at least one negative security condition and presented in green in the absence of at least one detected negative security condition.

5. The storage medium of claim 1, wherein the particular visual indicator identifies absence of at least one negative security condition within the particular computing system.

6. The storage medium of claim 1, wherein the particular visualization of the particular security view pane includes an interactive visualization of particular security conditions.

7. The storage medium of claim 6, wherein an interaction with the particular visualization causes another visualization of the particular security conditions to be presented within the particular security view pane.

8. The storage medium of claim 7, wherein the particular visualization represents the particular security conditions at a first level of abstraction and the other visualization represents the particular conditions at a second level of abstraction.

9. The storage medium of claim 6, wherein interaction with the particular visualization includes inputs in connection with the performance of a particular security task.

10. The storage medium of claim 9, wherein the interaction with the particular visualization causes at least one interface to populate the particular security view pane, the interface adapted to receive the inputs.

11. The storage medium of claim 1, wherein a plurality of the security view panes included in the dashboard are in an expanded state.

12. The storage medium of claim 1, wherein a plurality of the security view panes included in the dashboard are in a collapsed state.

13. The storage medium of claim 12, wherein each security view pane in the plurality of collapsed security view panes includes a respective visual indicator summarizing at least a portion of the particular security conditions identified in visualizations of the corresponding security view pane.

14. The storage medium of claim 13, wherein each visual indicator mimics a visualization technique used in visualizations of the corresponding security view pane.

15. The storage medium of claim 14, wherein at least one visual indicator of the plurality of collapsed security view panes is different from the particular visual indicator.

16. The storage medium of claim 1, wherein the plurality of security view panes comprises a subset of security view panes from a set of available security view panes.

17. The storage medium of claim 1, the instructions when executed on a machine to further cause the machine to:

identify an interaction with the particular security view pane; and

change the positioning of the particular security view pane relative to at least one other security view pane in the plurality of security view panes based on the interaction.

18. The storage medium of claim 17, wherein the changing the positioning of the particular security view pane causes at least one other security view pane in the plurality of security view panes to be repositioned to accommodate the changing of the positioning of the particular security view pane.

19. The storage medium of claim 17, wherein the interaction moves the particular security view pane to a primary viewing area included in the dashboard, and positioning a security view pane within the primary viewing area causes the security view pane to be expanded horizontally.

20. The storage medium of claim 19, wherein the primary viewing area occupies a position substantially near the top of the dashboard.

21. The storage medium of claim 19, wherein the primary viewing area is adapted to collapse when not occupied by at least one security view pane.

22. The storage medium of claim 1, wherein the particular visualization is a trendline.

23. A method comprising:

receiving data describing security conditions detected in a particular computing system by one or more security sensors;

providing a computing system security dashboard for presentation on a computer display device, the dashboard to include a plurality of collapsible security view panes, each security view pane, when expanded, to present a respective visualization of a corresponding category of security conditions of the particular computing system and, when collapsed, to hide at least a portion of the visualization presented when the corresponding security view pane is expanded, each security view pane to occupy a smaller area of the dashboard when collapsed than when expanded,

at least a particular one of the plurality of security view panes is to present a particular visualization representing particular security conditions related to a particular category and further present a particular visual indicator, at least when collapsed, summarizing at least a portion of the particular security conditions represented in the hidden particular visualization,

the particular visualization graphically represents chronological progress of the particular security conditions over a period of time and at least one indication of whether a critical event has been detected with respect to the chronological progress of the particular security conditions during at least one portion of the period of time, and the particular security conditions are for each element of the group consisting of processors, memory, storage, storage access, software update, and network traffic; and

identifying an interaction with the particular collapsed security view pane prompting the particular security view pane to be expanded in area and present the particular visualization.

24. The method of claim 23, wherein the particular visualization is a trendline.

25. A system comprising:

at least one processor device;

at least one memory element; and

a dashboard engine adapted, when executed by the at least one processor device, to

receive data describing security events determined from security conditions detected in a particular computing system by one or more security sensors;

provide a computing system security dashboard for presentation on a computer display device, the dashboard to include a plurality of collapsible security view panes, each security view pane, when expanded, to present a respective visualization of a corresponding category of security conditions of the particular computing system and, when collapsed, to hide at least a portion of the visualization presented when the corresponding security view pane is expanded, each security view pane is to occupy a smaller area of the dashboard when collapsed than when expanded,

at least a particular one of the plurality of security view panes is to present a particular visualization representing particular security conditions related to a particular category and further present a particular visual indicator, at least when collapsed, summarizing at least a portion of the particular security conditions represented in the hidden particular visualization,

the particular visualization is to graphically represent chronological progress of the particular security conditions over a period of time and at least one indication of whether a critical event has been detected with respect to the chronological progress of the particular security conditions during at least one portion of the period of time, and the particular security conditions are for each element of the group consisting of processors, memory, storage, storage access, software update, and network traffic; and

identify an interaction with the particular collapsed security view pane prompting the particular security view pane to be expanded in area and present the particular visualization.

26. The system of claim 25, wherein the dashboard engine is further adapted to provide a primary viewing area in the dashboard, and positioning of one or more security view panes within the primary viewing area causes the one or more security view panes positioned within the primary viewing area to be horizontally expanded.

27. The system of claim 25, wherein the dashboard engine interfaces with one or more security tools adapted to perform one or more security tasks, and the dashboard engine is further adapted to allow initiation of the one or more security tasks via the particular security view pane.

28. The system of claim 25, wherein the particular visualization is a trendline.